opencode-skills-collection 4.1.14 → 4.1.16

package/bundled-skills/social-proof-architect/SKILL.md

@@ -1,16 +1,22 @@
 ---
 name: social-proof-architect
-description: "One sentence - what this skill does and when to invoke it"
+description: "Select and place genuine testimonials, case studies, and other proof when an audience needs evidence at specific trust barriers."
 risk: safe
 source: community
 date_added: "2026-04-04"
 ---
-You are a **Social Psychologist specializing in conformity, trust, and influence**. Your task is to select, frame, and place the right type of social proof for a specific audience and context. You do not add proof as decoration. You match proof type to the trust gap.
+Use a marketing planning and audience-research lens. Your task is to select, frame, and place the right type of social proof for a specific audience and context. You do not add proof as decoration. You match proof type to the trust gap.
 
 ## When to Use
 - Use when testimonials, logos, numbers, or case studies need to be structured for maximum trust impact.
 - Use when social proof exists but is weakly placed or not tied to the buyer's main hesitation.
 
+## Evidence and scope
+
+Use observed audience research and verified product facts. Psychological interpretations and the author-year references below are inherited conceptual context, not validated evidence for this exact workflow or a guaranteed conversion effect. Before using a scientific claim externally, verify the actual publication, method and applicability; omit unsupported claims. This is marketing planning, not clinical diagnosis. Do not infer sensitive traits or exploit vulnerabilities.
+
+Original contribution: [PR 451](https://github.com/sickn33/agentic-awesome-skills/pull/451) by MMEHDI0606; [immutable source snapshot](https://github.com/MMEHDI0606/antigravity-awesome-skills/blob/9c61357e3e6bb167946036f52ac1e28fc82e04d0/skills/social-proof-architect/SKILL.md). This identifies the contributed instructions, not scientific validation or a new upstream endorsement.
+
 ## CONTEXT GATHERING
 
 Before designing social proof, establish:
@@ -31,23 +37,23 @@ People use social proof as a shortcut for uncertainty reduction, especially when
 
 **Step 1 - Identify the trust gap**
 Name what is missing: ability, benevolence, integrity, popularity, similarity, or legitimacy.
-*Research basis: trust formation depends on distinct credibility dimensions, not one generic confidence factor (Mayer trust model; Rowley et al., 2015).*
+*Planning hypothesis (verify before presenting as research): trust formation depends on distinct credibility dimensions, not one generic confidence factor (Mayer trust model; Rowley et al., 2015).*
 
 **Step 2 - Select the proof type**
 Choose peer similarity, authority, usage volume, certification, or outcome case studies.
-*Research basis: similarity, authority, and bandwagon cues do not work equally across categories (Li et al., 2021; Bagozzi et al., 2021).*
+*Planning hypothesis (verify before presenting as research): similarity, authority, and bandwagon cues do not work equally across categories (Li et al., 2021; Bagozzi et al., 2021).*
 
 **Step 3 - Match proof to awareness stage**
 Use softer proof early and stronger proof later when skepticism increases.
-*Research basis: proof is most persuasive when it supports rather than replaces the audience's own reasoning (ELM; Quick et al., 2018).*
+*Planning hypothesis (verify before presenting as research): proof is most persuasive when it supports rather than replaces the audience's own reasoning (ELM; Quick et al., 2018).*
 
 **Step 4 - Frame the proof honestly**
 Use real context, not cherry-picked outcomes.
-*Research basis: fake or overstated proof creates backlash and skepticism once detected (Nguyen-Viet & Nguyen, 2024; Nagy et al., 2022).*
+*Planning hypothesis (verify before presenting as research): fake or overstated proof creates backlash and skepticism once detected (Nguyen-Viet & Nguyen, 2024; Nagy et al., 2022).*
 
 **Step 5 - Place proof where doubt peaks**
 Insert proof immediately before a risky decision, not randomly.
-*Research basis: trust is stage-specific and should be deployed at the friction point, not only in a testimonial block (Rowley et al., 2015; Du et al., 2023).*
+*Planning hypothesis (verify before presenting as research): trust is stage-specific and should be deployed at the friction point, not only in a testimonial block (Rowley et al., 2015; Du et al., 2023).*
 
 ## DECISION MATRIX
 
@@ -95,7 +101,7 @@ The line between persuasion and manipulation is presenting evidence that helps a
 
 ## SKILL CHAINING
 
-Before invoking this skill, the agent should have completed:
+Optional context from related skills (equivalent supplied research is sufficient; do not create a prerequisite cycle):
 - [ ] `@customer-psychographic-profiler`
 - [ ] `@trust-calibrator`
 - [ ] `@awareness-stage-mapper`
@@ -104,7 +110,7 @@ This skill's output feeds into:
 - [ ] `@copywriting-psychologist`
 - [ ] `@pitch-psychologist`
 - [ ] `@sequence-psychologist`
-- [ ] `@landing-page`-style outputs
+- [ ] landing-page drafts
 
 ## OUTPUT QUALITY CHECK
 
@@ -121,6 +127,8 @@ Before finalizing output, the agent asks:
 
 > Reorganize these testimonials, logos, metrics, and case studies to maximize trust without overstating the evidence.
 
+**Illustrative output:** Place an authorized testimonial beside the feature it actually discusses; include its context and date, and do not present one testimonial as a typical customer outcome.
+
 ## Limitations
 - Use this skill only when the task clearly matches the scope described above.
 - Do not treat the output as a substitute for environment-specific validation, testing, or expert review.

package/bundled-skills/spark-optimization/SKILL.md

@@ -20,7 +20,6 @@ Production patterns for optimizing Apache Spark jobs including partitioning stra
 - Clarify goals, constraints, and required inputs.
 - Apply relevant best practices and validate outcomes.
 - Provide actionable steps and verification.
-- If detailed examples are required, open `resources/implementation-playbook.md`.
 
 ## Use this skill when
 

package/bundled-skills/speckit-updater/SKILL.md

@@ -5,6 +5,13 @@ risk: critical
 source: community
 date_added: "2026-09-04"
 ---
+## Supporting material availability
+
+This catalog copy contains the inline guidance below, but does not include the following supporting paths. They are external prerequisites, not bundled files:
+
+
+Ask for the original supporting material or an existing installation before using a step that depends on these paths; this catalog does not identify a verified download source for them. Resolve each path relative to that installation, inspect its contents, and verify any applicable license and execution prerequisites. Do not run a command or claim a referenced procedure was followed until its required file exists. Do not fabricate the missing scripts or treat an unrelated file with the same name as equivalent. Independent steps fully documented here can proceed within the user’s authorized scope; report any dependent step as unavailable.
+
 
 # SpecKit Safe Update
 

package/bundled-skills/speed/SKILL.md

@@ -24,20 +24,22 @@ Launch the RSVP speed reader to display text one word at a time with Spritz-styl
    - Otherwise, extract the main content from your **previous response** in this conversation
 
 2. **Prepare the content:**
-   - Strip markdown formatting (headers, bold, links, code blocks)
-   - Keep clean, readable prose
-   - Escape quotes and backslashes for JavaScript
-
-3. **Write and launch:**
-   - Read `~/.claude/skills/speed/data/reader.html`
-   - Replace `<!-- CONTENT_PLACEHOLDER -->` with:
-     ```html
-     <script>window.SPEED_READER_CONTENT = "your escaped text";</script>
-     <!-- CONTENT_PLACEHOLDER -->
-     ```
-   - Run: `open ~/.claude/skills/speed/data/reader.html`
-
-4. **Confirm:** Tell the user it's opening. Mention `Space` to play/pause.
+   - Preserve meaningful prose; do not discard user-requested code or numbers silently.
+   - Use a reviewed, actually installed reader template. The historical
+     `~/.claude/skills/speed/data/reader.html` path is not bundled by this AAS skill.
+   - Keep original assets immutable: write a separate private preview copy.
+
+3. **Serialize safely:**
+   - Serialize text as JSON rather than ad-hoc quote replacement. When embedding
+     JSON inside a script element, escape `<` as `\u003c` (and any required Unicode
+     separators) so supplied `</script>` text cannot become executable HTML.
+   - Do not put source text into shell arguments or execute its contents.
+   - If the template is absent, report the missing runtime; do not pretend a reader opened.
+
+4. **Launch and verify:**
+   - Open the preview using the current host's supported local-file action, not a
+     macOS-only command on every platform. Inspect actual displayed text and controls.
+   - Confirm opening only after successful host evidence; adjust speed to the user.
 
 ## Arguments
 $ARGUMENTS

package/bundled-skills/sred-project-organizer/SKILL.md

@@ -5,6 +5,13 @@ risk: critical
 source: community
 date_added: "2026-09-04"
 ---
+## Supporting material availability
+
+This catalog copy contains the inline guidance below, but does not include the following supporting paths. They are external prerequisites, not bundled files:
+
+
+Ask for the original supporting material or an existing installation before using a step that depends on these paths; this catalog does not identify a verified download source for them. Resolve each path relative to that installation, inspect its contents, and verify any applicable license and execution prerequisites. Do not run a command or claim a referenced procedure was followed until its required file exists. Do not fabricate the missing scripts or treat an unrelated file with the same name as equivalent. Independent steps fully documented here can proceed within the user’s authorized scope; report any dependent step as unavailable.
+
 
 # SRED Project Organization
 

package/bundled-skills/startup-analyst/SKILL.md

@@ -21,7 +21,6 @@ date_added: '2026-02-27'
 - Clarify goals, constraints, and required inputs.
 - Apply relevant best practices and validate outcomes.
 - Provide actionable steps and verification.
-- If detailed examples are required, open `resources/implementation-playbook.md`.
 
 You are an expert startup business analyst specializing in helping early-stage companies (pre-seed through Series A) with market sizing, financial modeling, competitive strategy, and business planning.
 

package/bundled-skills/startup-business-analyst-business-case/SKILL.md

@@ -29,7 +29,6 @@ Generate a comprehensive, investor-ready business case document covering market
 - Clarify goals, constraints, and required inputs.
 - Apply relevant best practices and validate outcomes.
 - Provide actionable steps and verification.
-- If detailed examples are required, open `resources/implementation-playbook.md`.
 
 ## What This Command Does
 

package/bundled-skills/startup-business-analyst-financial-projections/SKILL.md

@@ -29,7 +29,6 @@ Create a comprehensive 3-5 year financial model with revenue projections, cost s
 - Clarify goals, constraints, and required inputs.
 - Apply relevant best practices and validate outcomes.
 - Provide actionable steps and verification.
-- If detailed examples are required, open `resources/implementation-playbook.md`.
 
 ## What This Command Does
 

package/bundled-skills/startup-business-analyst-market-opportunity/SKILL.md

@@ -29,7 +29,6 @@ Generate a comprehensive market opportunity analysis for a startup, including To
 - Clarify goals, constraints, and required inputs.
 - Apply relevant best practices and validate outcomes.
 - Provide actionable steps and verification.
-- If detailed examples are required, open `resources/implementation-playbook.md`.
 
 ## What This Command Does
 

package/bundled-skills/startup-financial-modeling/SKILL.md

@@ -25,7 +25,7 @@ Build comprehensive 3-5 year financial models with revenue projections, cost str
 - Clarify goals, constraints, and required inputs.
 - Apply relevant best practices and validate outcomes.
 - Provide actionable steps and verification.
-- If detailed examples are required, open `resources/implementation-playbook.md`.
+- Use the examples below; no separate implementation playbook is bundled.
 
 ## Overview
 
@@ -91,8 +91,8 @@ ARR = MRR × 12
 
 **Formula:**
 ```
-Runway = Current Cash Balance / Monthly Burn Rate
-Monthly Burn = Monthly Revenue - Monthly Expenses
+Net Cash Burn = Cash Outflows - Operating Cash Inflows
+Runway = Current Cash Balance / Net Cash Burn  # only when Net Cash Burn > 0
 ```
 
 ### Headcount Planning
@@ -115,25 +115,27 @@ Track headcount by department and role.
 
 ### Three-Scenario Framework
 
-**Conservative Scenario (P10):**
+**Conservative Scenario:**
 - Slower customer acquisition
 - Lower pricing or conversion
 - Higher churn rates
 - Extended sales cycles
 - Used for cash management
 
-**Base Scenario (P50):**
+**Base Scenario:**
 - Most likely outcomes
 - Realistic assumptions
 - Primary planning scenario
 - Used for board reporting
 
-**Optimistic Scenario (P90):**
+**Optimistic Scenario:**
 - Faster growth
 - Better unit economics
 - Lower churn
 - Used for upside planning
 
+These are explicitly chosen scenarios, not measured probability percentiles. Do not label them P10/P50/P90 unless a documented probabilistic model and sampling justify those quantiles.
+
 ### Time Horizon
 
 **Detailed Projections: 3 Years**
@@ -235,10 +237,11 @@ Beginning Cash
 **Runway Calculation:**
 ```
 If Ending Cash < 0:
-  Funding Need = Negative Cash Balance
+  Funding Need = -Ending Cash
   Runway = 0
 Else:
-  Runway = Ending Cash / Average Monthly Burn
+  Runway = Ending Cash / Average Positive Monthly Net Cash Burn
+If Net Cash Burn <= 0: report runway as not applicable, not a negative duration
 ```
 
 ### Step 6: Calculate Key Metrics
@@ -299,7 +302,7 @@ Create three scenarios with different assumptions.
 
 **Example Projection:**
 ```
-Year 1: $500K ARR, 50 customers, $100K MRR by Dec
+Year 1: $500K ARR, 50 customers, $41.7K MRR by Dec
 Year 2: $2.5M ARR, 200 customers, $208K MRR by Dec
 Year 3: $8M ARR, 600 customers, $667K MRR by Dec
 ```
@@ -432,21 +435,9 @@ Compare key metrics to similar companies at similar stage.
 **Investor Feedback:**
 Share model with advisors or investors for feedback on assumptions.
 
-## Additional Resources
-
-### Reference Files
-
-For detailed model structures and advanced techniques:
-- **`references/model-templates.md`** - Complete financial model templates by business model
-- **`references/unit-economics.md`** - Deep dive on CAC, LTV, payback, and efficiency metrics
-- **`references/fundraising-scenarios.md`** - Modeling funding rounds and dilution
-
-### Example Files
+## Local Resources
 
-Working financial models with formulas:
-- **`examples/saas-financial-model.md`** - Complete 3-year SaaS model with cohort analysis
-- **`examples/marketplace-model.md`** - Marketplace GMV and take rate projections
-- **`examples/scenario-analysis.md`** - Three-scenario framework with sensitivities
+This skill is self-contained. Build a project-owned model from the formulas above; no complete spreadsheet, reference bundle or executable model is included. Treat all percentages and example projections as illustrative assumptions, not verified benchmarks.
 
 ## Quick Start
 
@@ -456,13 +447,13 @@ To create a startup financial model:
 2. **Project revenue** - Cohort-based with retention
 3. **Model costs** - COGS, S&M, R&D, G&A by month
 4. **Plan headcount** - Hiring by role and department
-5. **Calculate cash flow** - Revenue - expenses = burn/runway
+5. **Calculate cash flow** - Separate collections from recognized revenue; net cash burn is cash outflows minus operating cash inflows, and runway is defined only for positive burn.
 6. **Compute metrics** - CAC, LTV, burn multiple, runway
 7. **Create scenarios** - Conservative, base, optimistic
 8. **Validate assumptions** - Sanity check and benchmark
 9. **Integrate fundraising** - Model funding rounds and milestones
 
-For complete templates and formulas, reference the `references/` and `examples/` files.
+Record assumptions and validate formulas in the project-owned model.
 
 ## Limitations
 - Use this skill only when the task clearly matches the scope described above.

package/bundled-skills/subject-line-psychologist/SKILL.md

@@ -1,16 +1,22 @@
 ---
 name: subject-line-psychologist
-description: "One sentence - what this skill does and when to invoke it"
+description: "Draft email subject lines and notification copy matched to audience and sequence position when earning attention requires clarity and truthful curiosity."
 risk: safe
 source: community
 date_added: "2026-04-04"
 ---
-You are a **Cognitive Psychologist specializing in attention, curiosity, and open-rate behavior**. Your task is to engineer email subject lines and notification copy that achieve opens through psychological triggers matched to the audience and sequence position.
+Use a marketing planning and audience-research lens. Your task is to engineer email subject lines and notification copy that achieve opens through psychological triggers matched to the audience and sequence position.
 
 ## When to Use
 - Use when email subject lines need stronger open-rate psychology without losing clarity.
 - Use when you want multiple subject-line angles tuned to curiosity, relevance, or urgency.
 
+## Evidence and scope
+
+Use observed audience research and verified product facts. Psychological interpretations and the author-year references below are inherited conceptual context, not validated evidence for this exact workflow or a guaranteed conversion effect. Before using a scientific claim externally, verify the actual publication, method and applicability; omit unsupported claims. This is marketing planning, not clinical diagnosis. Do not infer sensitive traits or exploit vulnerabilities.
+
+Original contribution: [PR 451](https://github.com/sickn33/agentic-awesome-skills/pull/451) by MMEHDI0606; [immutable source snapshot](https://github.com/MMEHDI0606/antigravity-awesome-skills/blob/9c61357e3e6bb167946036f52ac1e28fc82e04d0/skills/subject-line-psychologist/SKILL.md). This identifies the contributed instructions, not scientific validation or a new upstream endorsement.
+
 ## CONTEXT GATHERING
 
 Before writing subject lines, establish:
@@ -31,23 +37,23 @@ People open messages when the subject line signals relevance, opens a curiosity
 
 **Step 1 - Define the open reason**
 Decide whether the subject line should trigger curiosity, identity, urgency, reassurance, or specificity.
-*Research basis: different attention states respond to different cues (attentional capture research; Song et al., 2024).*
+*Planning hypothesis (verify before presenting as research): different attention states respond to different cues (attentional capture research; Song et al., 2024).*
 
 **Step 2 - Build the smallest useful gap**
 Create a gap the reader can plausibly close by opening the message.
-*Research basis: curiosity works when the answer is accessible and relevant (curiosity research; Green & Brock, 2000).*
+*Planning hypothesis (verify before presenting as research): curiosity works when the answer is accessible and relevant (curiosity research; Green & Brock, 2000).*
 
 **Step 3 - Add self-reference when useful**
 Use the reader's own problem, role, or aspiration if it feels natural.
-*Research basis: self-relevance increases attention and processing (Moyer-Gusé et al., 2022; Ooms et al., 2019).*
+*Planning hypothesis (verify before presenting as research): self-relevance increases attention and processing (Moyer-Gusé et al., 2022; Ooms et al., 2019).*
 
 **Step 4 - Check sender trust interaction**
 Make sure the subject line and sender name work together.
-*Research basis: open behavior depends on trust, not just wording (Rowley et al., 2015).*
+*Planning hypothesis (verify before presenting as research): open behavior depends on trust, not just wording (Rowley et al., 2015).*
 
 **Step 5 - Sanity-check for promise continuity**
 Confirm the email body resolves the promise cleanly.
-*Research basis: overpromising harms trust and future opens (Nagy et al., 2022).*
+*Planning hypothesis (verify before presenting as research): overpromising harms trust and future opens (Nagy et al., 2022).*
 
 ## DECISION MATRIX
 
@@ -94,7 +100,7 @@ The line between persuasion and manipulation is using the subject line to earn a
 
 ## SKILL CHAINING
 
-Before invoking this skill, the agent should have completed:
+Optional context from related skills (equivalent supplied research is sufficient; do not create a prerequisite cycle):
 - [ ] `@sequence-psychologist`
 - [ ] `@customer-psychographic-profiler`
 - [ ] `@awareness-stage-mapper`
@@ -118,6 +124,8 @@ Before finalizing output, the agent asks:
 
 > Rewrite these email subject lines for stronger open-rate psychology while preserving clarity and truthful claims.
 
+**Illustrative output:** For a requested account export, use “Your CSV export is ready” only after the export succeeds; do not disguise a marketing email as a transactional notification.
+
 ## Limitations
 - Use this skill only when the task clearly matches the scope described above.
 - Do not treat the output as a substitute for environment-specific validation, testing, or expert review.

package/bundled-skills/superpowers-lab/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: superpowers-lab
-description: "Lab environment for Claude superpowers"
+description: "Evaluate experimental Claude workflow skills in an isolated lab with reproducible tasks, observed results, and explicit adoption criteria."
 risk: safe
 source: "https://github.com/obra/superpowers-lab"
 date_added: "2026-02-27"
@@ -8,27 +8,22 @@ date_added: "2026-02-27"
 
 # Superpowers Lab
 
-## Overview
+## When to Use
+- You want to evaluate an experimental workflow from the upstream Superpowers lab before adopting it.
+- You need a reproducible comparison of baseline behavior and a proposed skill.
 
-Lab environment for Claude superpowers
-
-## When to Use This Skill
-
-Use this skill when you need to work with lab environment for claude superpowers.
-
-## Instructions
-
-This skill provides guidance and patterns for lab environment for claude superpowers.
-
-For more information, see the [source repository](https://github.com/obra/superpowers-lab).
+## Workflow
+1. Select one experiment from the [upstream lab](https://github.com/obra/superpowers-lab). Read its instructions, status, prerequisites, and license before using it; this entry does not bundle the lab's experiments.
+2. Define a small representative task, success criteria, time/cost limits, and the files/tools each run may access. Use disposable fixtures and no production credentials.
+3. Record the baseline agent/tool configuration and run the task without the experimental skill. Capture outputs, observed failures, and validation results.
+4. Review the experiment's complete content and any commands before loading it. Run the same task with the experimental skill in an isolated workspace under the same permissions and acceptance criteria.
+5. Compare the actual outputs and failures. Separate observed improvements from subjective preferences; record changed model/tool settings as confounders.
+6. Decide whether to retain, revise, or reject the experiment. Keep production adoption separate from the lab run, and include a rollback/removal plan if adoption is proposed.
 
 ## Example
-
-**User request:**
-
-> Use @superpowers-lab for this task: Lab environment for Claude superpowers.
+> Compare one lab workflow against our baseline on a disposable bug-fix fixture. Report tests and failure modes without installing it globally.
 
 ## Limitations
-- Use this skill only when the task clearly matches the scope described above.
-- Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
-- Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.
+- Experimental guidance is not a production guarantee. Do not infer compatibility or improvement without a controlled run.
+- The original experiment and its fixtures are external prerequisites; report unavailable materials.
+- Do not execute unreviewed scripts, expand permissions, or use private production data for the experiment.

package/bundled-skills/supply-chain-security/SKILL.md

@@ -61,12 +61,12 @@ Layer 6: 事件响应 → 供应链攻击应急、回滚策略
 osv-scanner scan -r . --format json
 
 # OWASP Dependency-Track（企业级持续监控）
-docker run -p 8080:8080 dependencytrack/apiserver
+# Deployment requires reviewed configuration, digest, access controls and authorization.
 # → 上传 SBOM → 自动匹配 NVD/OSV/GitHub Advisory
 
 # Snyk（商业）
 snyk test --all-projects
-snyk monitor  # 持续监控
+# Persistent monitoring is a separately authorized operation.
 
 # Trivy（容器 + 依赖 + IaC）
 trivy fs .          # 文件系统扫描
@@ -77,7 +77,7 @@ trivy config .      # IaC 配置
 ### 3. 漏洞可达性验证
 
 ```text
-SCA 告警 ≠ 实际风险！大多数 SCA 工具只有 ~15% 的告警是实际可达的。
+SCA 告警需要结合实际版本、暴露面和调用路径验证。未提供可复现样本时，不声称固定的可达比例。
 
 验证步骤：
 1. 用 Dependency-Track 或 Trivy 获取 CVE 列表
@@ -147,17 +147,9 @@ cosign verify --key cosign.pub myimage:tag
 
 ## 工具链
 
-| 工具 | 用途 | 获取 |
-|------|------|------|
-| OWASP Dependency-Track | 企业级持续 SCA | `docker pull dependencytrack/apiserver` |
-| OSV-Scanner | 免费 SCA（OSV.dev 生态） | `go install github.com/google/osv-scanner` |
-| Trivy | 镜像 + 依赖 + IaC 扫描 | `apt install trivy` |
-| Syft | SBOM 生成 | `curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh` |
-| cdxgen | CycloneDX SBOM 生成 | `npm install -g @cyclonedx/cdxgen` |
-| Cosign | 容器签名 | `go install github.com/sigstore/cosign/v2/cmd/cosign` |
-| Gitleaks | 密钥/凭证扫描 | `go install github.com/gitleaks/gitleaks/v8` |
-| Snyk | 商业 SCA + 可达性 | `npm install -g snyk` |
-| CodeQL | 代码查询 + 数据流 | GitHub Actions 内置 |
+使用项目已安装并锁定版本的 OSV-Scanner、Trivy、Syft、cdxgen、Cosign、Gitleaks 或 CodeQL。核对真实可执行路径及官方版本说明；安装新工具需先审核来源、不可变版本和校验和，不执行在线下载脚本或自动全局安装。工具能力、付费条件和可达性支持取决于实际版本，不能从工具名推断。
+
+扫描私有依赖、上传 SBOM、持续监控、公开镜像拉取、签名及推送均有网络、数据或成本边界。先确认目标和授权；默认仅在获准的本地目录生成报告，不启动服务或注册监控。
 
 ## 参考
 

package/bundled-skills/supply-chain-security/references/cicd-pipeline-security.md

@@ -94,44 +94,8 @@ cosign verify-blob --key cosign.pub --signature artifact.tar.gz.sig artifact.tar
 
 ## 自动化检查 Pipeline
 
-```yaml
-# .github/workflows/supply-chain.yml
-name: Supply Chain Security
-on: [push, pull_request]
-
-jobs:
-  sca:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      
-      - name: SBOM Generate
-        run: |
-          npm install -g @cyclonedx/cdxgen
-          cdxgen -o sbom.json
-      
-      - name: OSV Scan
-        run: |
-          go install github.com/google/osv-scanner/cmd/osv-scanner@latest
-          osv-scanner scan --sbom sbom.json --format sarif > osv-results.sarif
-      
-      - name: Trivy Scan
-        uses: aquasecurity/trivy-action@master
-        with:
-          scan-type: fs
-          severity: CRITICAL,HIGH
-          exit-code: 1
-      
-      - name: Secret Scan
-        run: |
-          docker run --rm -v $PWD:/src ghcr.io/gitleaks/gitleaks:latest \
-            detect --source /src --verbose
-      
-      - name: Dependency-Track Upload
-        run: |
-          curl -X POST https://dtrack.example.com/api/v1/bom \
-            -H "X-Api-Key: ${{ secrets.DTRACK_API_KEY }}" \
-            -F "autoCreate=true" -F "project=myapp" -F "bom=@sbom.json"
-```
+通过项目已有且锁定版本的工具运行本地 SBOM、SCA、镜像和密钥扫描。外部 Actions 必须绑定经核验的完整提交 SHA；扫描失败保持非零退出，不将失败当作成功。不要安装 @latest 工具、执行未固定 Action 或默认上传结果。
+
+上传 SBOM 到 Dependency-Track 或其他服务前，核对接收方、项目身份、私有依赖泄露风险及许可；获得授权后才能单独配置上传步骤。使用环境变量传递秘密，不把 Actions 表达式直接插入 shell 代码；通知和定时监控需明确授权。当前文档不提供未经验证的第三方自动执行流水线。
 
 Source: SLSA Framework, OWASP CI/CD Top 10, GitHub Security Lab

package/bundled-skills/swiftui-ui-patterns/SKILL.md

@@ -32,6 +32,10 @@ Choose a track based on your goal:
 - Choose the next component reference based on the UI you need first (TabView, NavigationStack, Sheets).
 - Expand the route and sheet enums as new screens are added.
 
+## Example prerequisites
+
+The references contain application sketches, not a complete app. Supply the named project views, models, adapters and theme tokens; verify imports, actual error contracts and minimum OS with the installed SDK before adapting them. Bind every visible action to a real tested handler, make persistence failures observable and use inert preview data. A successful code example is not evidence of a tested screen or deployed service.
+
 ## General rules to follow
 
 - Use modern SwiftUI state (`@State`, `@Binding`, `@Observable`, `@Environment`) and avoid unnecessary view models.

package/bundled-skills/swiftui-ui-patterns/references/async-state.md

@@ -22,7 +22,7 @@ struct DetailView: View {
 
   var body: some View {
     content
-      .task {
+      .task(id: id) {
         await load()
       }
   }
@@ -42,10 +42,13 @@ struct DetailView: View {
   private func load() async {
     state = .loading
     do {
-      state = .loaded(try await client.fetch(id: id))
+      let item = try await client.fetch(id: id)
+      try Task.checkCancellation()
+      state = .loaded(item)
     } catch is CancellationError {
       return
     } catch {
+      guard !Task.isCancelled else { return }
       state = .failed(error)
     }
   }
@@ -66,16 +69,19 @@ struct SearchView: View {
     }
     .searchable(text: $query)
     .task(id: query) {
-      try? await Task.sleep(for: .milliseconds(250))
-      guard !Task.isCancelled, !query.isEmpty else {
-        results = []
-        return
-      }
+      let requestedQuery = query
       do {
-        results = try await client.search(query)
+        try await Task.sleep(for: .milliseconds(250))
+        try Task.checkCancellation()
+        guard !requestedQuery.isEmpty else { results = []; return }
+        let fetched = try await client.search(requestedQuery)
+        try Task.checkCancellation()
+        guard query == requestedQuery else { return }
+        results = fetched
       } catch is CancellationError {
         return
       } catch {
+        guard !Task.isCancelled, query == requestedQuery else { return }
         results = []
       }
     }

package/bundled-skills/swiftui-ui-patterns/references/controls.md

@@ -29,7 +29,7 @@ Form {
 ```swift
 Section("Font Size") {
   Slider(value: $fontSizeScale, in: 0.5...1.5, step: 0.1)
-  Text("Scale: \(String(format: \"%.1f\", fontSizeScale))")
+  Text("Scale: \(String(format: "%.1f", fontSizeScale))")
     .font(.scaledBody)
 }
 ```